The Azure DevOps integration allows Scrut to monitor user access, repository permissions, and pipeline configurations to ensure secure CI/CD workflows. It tracks project-level roles, validates that pipelines follow secure deployment practices, and generates audit-ready evidence for compliance. In this article, you can learn how to connect your Azure DevOps account with Scrut.
What This Integration Does in Scrut
Automated Tests: Runs automated compliance checks that continuously evaluate your configurations against applicable compliance frameworks.
User Access Data: Fetches user details, roles, and permissions from Azure DevOps for Access Reviews.
Evidence Task: Scrut automatically attaches the evidence to the Code Review Results evidence task on the 15th and last day of the month.
Prerequisites
An active Azure DevOps account with admin access
Third-party OAuth access enabled at the organization level in Azure DevOps (covered in the setup steps below)
Pro Tip!
Log in to your Azure DevOps account before starting the integration to avoid being prompted to sign in mid-setup.
Permissions and Access Requirements
For Azure DevOps
The following read-only OAuth scopes are requested during the integration:
vso.code: Grants Scrut read access to source code and metadata about commits, changesets, branches, and other version control artifacts. Also, grants the ability to search code and be notified about version control events via service hooks.
vso.project: Grants Scrut read access to projects and teams.
For Scrut
Admin access to Scrut, or a Contributor role with access to the Integration module
Supported Versions
Scrut supports the Azure DevOps REST API v1 and v2. Features or data fields introduced in later API versions are not available.
Data Collected
Projects: All accessible projects in the connected organization
Code Repositories: Repositories within the selected projects
Branches: All branches within synced repositories
Pull Requests: Used for Code Review evidence collection
Sync Frequency
Data syncs automatically every 24 hours. You can also trigger a manual sync from the Azure DevOps integration settings page in Scrut.
Integration Setup
Step 1: Enable OAuth Access in Azure DevOps
Log in to Azure DevOps and go to Organization Settings.
Navigate to Security, then select Policies.
Turn on the Third-party application access via OAuth toggle.
Repeat steps 1 through 3 for every organization you want to sync with Scrut.
Heads Up!
If this toggle is off, Scrut cannot authenticate with your Azure DevOps account. Confirm it is enabled before proceeding.
Step 2: Connect the Integration in Scrut
Sign in to Scrut and select Integrations from the left navigation menu.
Go to the Integrations Library and select Version Control from the Categories panel.
Find and select Azure DevOps, then click Integrate.
On the Azure DevOps integration page, click Connect.
Scrut redirects you to the Microsoft authentication page. Sign in with your Azure DevOps credentials and click Accept to grant the required permissions.
Watch for the success notification and the Connected status indicator on the integration page.
Step 3: Configure Scope
On the Azure DevOps integration page in Scrut, click Configure Scope.
Select the repositories from which you want to collect pull request evidence.
Click Save.
What Happens Next?
Initial data sync
After setup is complete, Scrut begins syncing data from Azure DevOps automatically. You can monitor sync activity in the Audit Log on the Azure DevOps integration settings page. To trigger an immediate sync, click Sync Now on the integration page.
Review synced data
Navigate to the following locations in Scrut to verify that data has synced correctly:
Navigate to Tests to find automated test results tied to your Azure DevOps configurations.
Navigate to People → Access Reviews to create an access review to view synced user and access records.
Navigate to Compliance → Evidence Tasks and search for the Code Review Results evidence task. Scrut will automatically fetch and attach the required evidence from your Azure DevOps code repositories on the 15th and last day of the month.
Common Errors and Troubleshooting
Authentication failure
Possible solutions:
Confirm that you have admin access to the Azure DevOps organization you are connecting.
Verify that the Third-party application access via OAuth toggle is enabled under Organization Settings → Security → Policies.
Disconnect the integration and reconnect to re-trigger the OAuth flow.
Data not appearing in Scrut
Possible solutions:
Confirm that the correct repositories are selected under Configure Scope.
Wait up to 24 hours for the first sync to complete, or click Sync Now to trigger a manual sync.
Check the Audit Log on the integration page for any error entries.
Integration shows "Not Connected" after setup
Possible solutions:
Confirm that you clicked Accept on the Microsoft permissions screen during OAuth.
Verify that your Azure DevOps account has admin-level access.
Try reconnecting from the Azure DevOps integration page in Scrut.
FAQs
1: Why does Scrut request source code permissions for the Azure DevOps integration?
Azure DevOps bundles code repo access and pull request access under a single OAuth scope Code (read) with no option to grant pull request access independently. This is a platform-level limitation on Azure DevOps' end, and applies to other version control systems as well.
Scrut uses this permission solely to read pull request data for evidence collection. We do not write to, modify, or store your source code.
For reference, you can review the full list of Azure DevOps OAuth scopes in Microsoft's official documentation (search for Code (read) on the page).
2: What data does Scrut collect from Azure DevOps?
Scrut collects projects, code repositories, branches, and pull request records. This data is used for automated compliance checks and code review evidence collection.
3: Can I sync data from multiple Azure DevOps organizations?
Yes. Repeat the OAuth toggle setup (Step 1) for each organization you want to include, then select the relevant repositories under Configure Scope in Scrut.
4: When and how does Scrut collect code review evidence from Azure DevOps?
Scrut automatically fetches pull request and code review activity from your connected Azure DevOps repositories on the 15th and last day of each month, and attaches it to the Code Review Results evidence task under Compliance → Evidence Tasks. No manual action is required. Activity that occurs between collection dates is included in the next scheduled fetch.
This evidence demonstrates that your team follows a consistent code review process, which is a control requirement under frameworks such as SOC 2 and ISO 27001. Having it collected and attached automatically reduces the manual effort involved in audit preparation.
Reach out to support@scrut.io or contact your CSM for further assistance.